cryptographyfandomcom-20200215-history
Password Authenticated Key Exchange by Juggling
In cryptography, the Password Authenticated Key Exchange by Juggling (or J-PAKE) is a password-authenticated key agreement protocol F. Hao, P. Ryan. Password Authenticated Key Exchange by Juggling. ''Proceedings of the 16th International Workshop on Security Protocols, 2008.. This technique allows two parties to establish private and authenticated communication solely based on their shared (low-entropy) password without requiring a Public Key Infrastructure. It provides mutual authentication to the key exchange, a feature that is lacking in the Diffie-Hellman key exchange protocol. The authors suggest that J-PAKE may be helpful in avoiding patents in the field. Description Two parties, Alice and Bob, agree on a group G with generator g of prime order q in which the discrete log problem is hard. Typically a Schnorr group is used. In general, J-PAKE can use any prime order group that is suitable for public key cryptography, including Elliptic curve cryptography. Let s be their shared (low-entropy) secret, which can be a password or a hash of a password ( s \neq 0 ). The protocol executes in two rounds. ;Round 1: Alice selects x_1 \in_R q-1 , x_2 \in_R (0, q-1] and sends out g^{x_1} , g^{x_2} together with the Zero-knowledge proofs (using for example Schnorr signature) for the proof of the exponents x_1 and x_2 . Similarly, Bob selects x_3 \in_R q-1 , x_4 \in_R (0, q-1] and sends out g^{x_3} , g^{x_4} together with the Zero-knowledge proofs for the proof of the exponents x_3 and x_4 . The above communication can be completed in one round as neither party depends on the other. When it finishes, Alice and Bob verify the received Zero-knowledge proofs and also check g^{x_2}, g^{x_4} \neq 1 . ;Round 2: Alice sends out A = g^{(x_1 + x_3 + x_4) x_2 s} and a Zero-knowledge proof for the proof of the exponent x_2 s . (Note Alice actually derives a new public key using g^{x_1 + x_3 + x_4} as the generator). Similarly, Bob sends out B = g^{(x_1 + x_2 + x_3) x_4 s} and a Zero-knowledge proof for the proof of the exponent x_4 s . After Round 2, Alice computes K = (B/g^{x_2 x_4 s})^{x_2} = g^{(x_1 + x_3) x_2 x_4 s} . Similarly, Bob computes K = (A/g^{x_2 x_4 s})^ {x_4} = g^{(x_1 + x_3) x_2 x_4 s} . With the same keying material K , Alice and Bob can derive a session key using a Cryptographic hash function: \kappa = H(K) . The two-round J-PAKE protocol is completely symmetric. This helps significantly simplify the security analysis. For example, the proof that one party does not leak any password information in the data exchange must hold true for the other party based on the symmetry. This reduces the number of the needed security proofs by half. In practice, it is more likely to implement J-PAKE in three flows since one party shall normally take the initiative. This can be done trivially without loss of security. Suppose Alice initiates the communication by sending to Bob: g^{x_1}, g^{x_2} and Zero-knowledge proofs. Then Bob replies with: g^{x_3}, g^{x_4}, B = g^{(x_1 + x_2 + x_3) x_4 s} and Zero-knowledge proofs. Finally, Alice sends to Bob: A = g^{(x_1 + x_3 + x_4) x_2 s} and a Zero-knowledge proof. Both parties can now derive the same session key. Depending on the application requirement, Alice and Bob may perform an optional key confirmation step. There are several ways to do it. A simple method described in SPEKE works as follows: Alice sends to Bob H(H(\kappa)) , and then Bob replies with H(\kappa) . Alternatively, Alice and Bob can realize explicit key confirmation by using the newly constructed session key to encrypt a known value (or a random challenge). EKE, Kerberos and Needham-Schroeder all attempt to provide explicit key confirmation by exactly this method. Security properties The J-PAKE protocol is provably secure, fulfilling the following properties. # Off-line dictionary attack resistance - It does not leak any password verification information to a passive attacker. # Forward secrecy - It produces session keys that remain secure even when the password is later disclosed. # Known-key security - It prevents a disclosed session key from affecting the security of other sessions. # On-line dictionary attack resistance - It limits an active attacker to test only one password per protocol execution. The protocol design The J-PAKE protocol is designed by combining random public keys in such a structured way to achieve a vanishing effect iff both parties supplied exactly the same passwords. This is somehow similar to the Anonymous veto network protocol design. The essence of the idea, however, can be traced back to David Chaum's original Dining Cryptographers network protocolDavid Chaum. The Dining Cryptographers Problem: Unconditional Sender and Recipient Untraceability Journal of Cryptology, vol. 1, No, 1, pp. 65-75, 1988, where binary bits are combined in a structured way to achieve a vanishing effect. The implementation J-PAKE has been implemented in OpenSSL and OpenSSH as an experimental authentication protocol. References External links * A prototype demo of J-PAKE in C * A prototype demo of J-PAKE in Java * J-PAKE: From Dining Cryptographers to Jugglers Category:Cryptography Category:Cryptographic protocols